Method and system of conducting a cryptocurrency payment via a mobile device using a contactless token to store and protect a user's secret key

Abstract

A method and system of conducting a cryptocurrency payment via a mobile device, using a contactless token to store and protect a user's secret key. A cryptocurrency wallet encrypted with the secret key is received by the mobile device from the token. A cryptocurrency payment instruction is received by the mobile device, prompting for a user credential to approve the instruction. In response the mobile device sends to the token a message comprising the encrypted wallet together with the payment instruction and the user credential. Using the secret key, the token then decrypts the cryptocurrency wallet from the encrypted wallet and creates a payment transaction by digitally signing the payment instruction, and transmitting the payment transaction to a cryptocurrency network or exchange. Confirmation of the transaction requires either a PIN, biometric or fingerprint on the mobile device, or authentication via button press, PIN or fingerprint on the token.

Description

BENEFIT CLAIM[0001]This application claims the benefit under 35 U.S.C. § 120 as a Continuation-in-Part of application Ser. No. 14 / 855,186, filed Sep. 5, 2015, which is a Continuation-in-part of application Ser. No. 14 / 174,727, filed Feb. 6, 2014, which is a Continuation of application Ser. No. 14 / 091,183, filed Nov. 26, 2013, now U.S. Pat. No. 9,210,133, which is a Continuation-in-part of application Ser. No. 13 / 706,307, filed Dec. 5, 2012, now U.S. Pat. No. 9,135,425, and which claims the benefit under 35 U.S.C. § 119 of Great Britain application GB 1221433.4, filed Nov. 28, 2012, and Great Britain application GB 1303677.7, filed Mar. 1, 2013 and granted as GB 2496354.1. INTRODUCTION[0002]The present application relates to a method and system of authenticating a user to a computer resource accessed via a mobile device using a portable security token (for example a contactless smart card or bracelet), together with a secret that the user can easily remember (for example a PIN code)....

AI Technical Summary

Benefits of technology

[0002]The present application relates to a method and system of authenticating a user to a computer resource accessed via a mobile device using a portable security token (for example a contactless smart card or bracelet), together with a secret that the user can easily remember (for example a PIN code). This secret provides a second, separate preferably independent security factor that can safeguard the computer resource even if the portable security token and the mobile device are both lost or stolen together. A preferred embodiment relates to providing data protection and secure access to applications and stored data accessed via a mobile device (such as a phone or tablet) using a near-field communication (NFC) hardware token or a short range Bluetooth token.

[0013]This has a number of serious disadvantages, including the necessity of using secure storage on the device. This is normally not available to application developers as it is maintained and controlled by the manufacturer of the device (e.g. mobile phone) or the supplier of the underlying operating system or a mobile network operator. Also, making use solely of a token identifier as a means of validating the token is likely to be insecure. RFID tokens can typically be read by any compatible reader, and can easily be cloned.

[0022]With the present invention, the user may store a master key of high cryptographic strength (128 bits or above presently) on the portable security token, and this key can be used to either directly protect an app's data encryption key or a long and complex password, from which a sufficiently long and secure encryption key can be derived. This allows the user to protect any data stored on the device with a very strong encryption key. If the device is stolen, it is then infeasible for any potential attacker to decrypt the encrypted data on it without the associated token.

[0027]Credential synchronisation is possible across devices for the same user, obviating the need for manual entry of the same credentials multiple times.

Problems solved by technology

Despite the ubiquity of password-based systems, it has many problems.

However, in order for passwords to be secure, they should be long and hard to predict, contradictory to the former requirement.

For maximum security, this password should be long and complex.

However using a long and complex password as the password to unlock the lock screen is extremely inconvenient for the user.

Moreover, the confidential data is decrypted whenever the device has been unlocked, even when the user is not using the data, which increases the risk of a data breach unnecessarily.

The problem with this approach is that the key would either have to be protected by or derived from a password for security, or has to be stored within the app in plaintext form for usability.

The former approach inherits the same password complexity issue as the device encryption method above, while the latter offers little security as the attacker who could compromise the plaintext data could just as easily read the plaintext key and decrypt the data.

There are a number of disadvantages of such a system.

Theft of the mobile device and the token together renders the security system useless.

In particular changing of the application credential requires re-programming or replacement of the token; the number of user credentials secured by the system is limited by the (small) storage capacity of the token; and the loss of the token poses a direct risk of exposure of the user's credentials.

The system described cannot be used with pre-existing applications.

This has a number of serious disadvantages, including the necessity of using secure storage on the device.

Also, making use solely of a token identifier as a means of validating the token is likely to be insecure.

Again, the system described has a number of disadvantages, primarily that it uses a form of logical control that is relatively easy to circumvent.

More generally, in the enterprise environment there exists significant security risk from allowing users to connect mobile devices into the network due to increased likelihood of unauthorized data access (leading to loss of data confidentiality and / or integrity) resulting from:Inadvertently disclosed passcodes such as PINs or alphanumeric codes, e.g. from shoulder surfingEasily guessed passcodesLost or stolen devices that are inadequately protectedUnsupervized use of devices by a third partyThe Hoverkey system aims to provide solutions for applications to counter these threats.

If the device is stolen, it is then infeasible for any potential attacker to decrypt the encrypted data on it without the associated token.

Images